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We prove that for an arbitrarily small constant e > 0, assuming NP2DTIME(2l°§ '"), 
the preprocessing versions of the closest vector problem and the nearest codeword problem 

are hard to approximate within a factor better than 2'°§ " . This improves upon the previous 
hardness factor of (log nY for some <5 > due to IIAKKV05I . 



1 Introduction 

Given an integer lattice B and a target vector t in Z'", the CLOSEST VECTOR PROBLEM (CVP) 
asks for the vector in B nearest to t under the Ip norm. All p > 1 are interesting although, p = 2 
case has received the most attention. An integer lattice is a set of vectors {E/Li ^tj-fa, | a, G Z}, 
where bi, b2,---,b„ G Z"" is a set of linearly independent vectors, called the basis of the lattice. 
An important variation of CVP is the pre-processing version of the problem where the lattice B is 
known in advance and the algorithm is allowed arbitrary pre-processing on B before the input t 
is revealed. This is known as the CLOSEST VECTOR PROBLEM WITH PRE-PROCESSING (CVPP). A 
related problem is the Nearest Codeword Problem (NCP) where the input is a generator ma- 
trix C of a linear code over F2 and a target vector f . The goal is to find the codeword nearest to f in 
Hamming distance. Again, if C is known in advance and arbitrary pre-computation is allowed on 
it, the problem is known as the Nearest CODEWORD Problem with Pre-processing (NCPP). 

Pre-processing problems arise in cryptography and coding theory where, typically, a publicly 
known lattice (or a linear error-correcting code) is being used to transmit messages across a faulty 
channel. The decrypting or decoding of the received word is equivalent to solving an instance of 
CVP for the lattice being used in the protocol. The basis of the lattice being known beforehand, it 
becomes imperative to understand if the performance of the decoding algorithm can be improved, 
or if the security of the cryptographic protocol can be compromised (see [|FM04l |Reg04| for more 
details). 

Potentially, this pre-computated information could make CVPP easier than CVP. Indeed, using 
the so-called Korkine-Zolotarev basis, Lagarias et al. ||LLS90| constructed an 0(n^-^) factor approx- 
imation algorithm for CVPP, which is significantly better than the best known almost-exponential 
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20(niogiog«/ logn) approximation factor known for CVP, see IIMV10l lSch871. This n^-^ factor was im- 
proved to n by Regev [ Reg04| , and subsequently to Oi^^Jnl log n) by Aharonov and Regev |AR05| . 



As for the inapproximability of CVP, it was proved by Dinur zt al. IIDKRS03| that it is NP-hard to 
approximate to a factor within n'^^^°s^°S" for some constant c > 0. This improved an earlier result 
of IIABSS97I showing that it is quasi-NP hard to approximate to a factor within 2^°8^ for any 
constant £ > 0. Obtaining inapproximability results for CVPP has been a more challenging task: 
Feige and Micciancio [FM04| proved a Vs — e factor NP-hardness for NCPP for any constant e > 0. 



This was improved to 3 — £ by Regev |Reg04|. These authors observed that a factor C hardness 
for NCPP implies a factor C^^P hardness for CVPP under the ip norm for any 1 < p < oo. Also, 
hardness results in the ico case can be obtained by using the norm-embedding technique due to 
Regev and Rosen llRR06l . 

The inapproximability results were improved in I'A KKVOSi who proved a factor C NP-hardness 
for CVPP and NCPP for any constant C. [AKKV05J showed how their result can be extended to 
a hardness of (logn)'' for some S > under the assumption that NP ^ DTIME(2f"''i/(i°S")). They 
also give another reduction which achieves a hardness factor of (log n)^^*^ for NCPP for any £ > 0. 
This latter reduction is under a certain unproved hypothesis about a pre-processing version of the 
PCP Theorem. ^ 

1.1 Main Result and Overview 

The following is the main theorem of this paper. 

Theorem 1.1 (Main Theorem). Unless NP C Dr7ME(2i°8°*'^'' "), NCPP and CVPP are hard to 
approximate to a factor within 2^°s '"for an arbitrarily small constant £ > 0. 

This improves on the previous hardness factor of (logn)'' for some ^ > due to |AKKV05II and 
essentially matches the almost pol}momial factor inapproximability of Dinur et al. IIDKRS03II for 
CVP. We emphasize that unlike the case of CVP where the best approximation algorithm achieves 
a factor of 2"^°S^°S"/^oS"^ the best approximation algorithm for CVPP achieves an approximation 
factor of 0(-yn/ logn). 

Overview of the proof. We will show a hardness factor of 2^°^^ ' " for the MINIMUM Weight 
Solution Problem with Pre-processing (MWSPP). The input to this problem consists of a 
set affixed linear forms described by G Fj^^ , a set of variable linear forms B-o G Fj^^ and 
a target vector t E V^- The goal is to find a solution x G F^ to the system BfX = t, which 
minimizes the Hamming weight of the vector B^x. We allow arbitrary pre-processing on all parts 
of the input except the vector t. It is easy to check that MWSPP is a reformulation of NCPP. 



Henceforth, we focus on the MWSPP problem. See Section 2.1 for preliminaries and definitions 
and the equivalence of MWSPP with NCPP. 

Our reduction builds on the second reduction of IIAKKV05II to MWSPP. The authors in IIAKKV05I 
make a certain hypothesis about the pre-processing version of the PCP Theorem. This hypothesis 



^The authors claim to have a proof, but do not include it in the paper. 
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leads to the hardness of approximation of a pre-processing version of the Label Cover problem. 
Recall that an instance of LABEL COVER is given by a bipartite graph G = {V, W, E, [R], [S] ) and 
for each edge e = {v,w) ^ V x W, a function Ue : [R] i— > [S] . A labeling to the graph consists of an 
assignment A : V [R], W i— )■ [S] . An edge e = {v, w) is said to be satisfied by an assignment A if 
7re(A(c)) = A{w). The value of an instance is the maximum fraction of edges that can be satisfied 
by any labeling. 



It is a consequence of the PCP Theorem ||AS98[ |ALM^98l and Raz's Parallel Repetition Theorem 



[Raz98| that for every constant R, given an instance of Label Cover it is NP-hard to distinguish 
whether the value of the instance is 1 or at most R^"^ for some absolute constant 7 > 0. The authors 
in PAKKVOSI show that a similar hardness holds for the LCPP problem under their hypothesis. In 
the LCPP problem, the label set [R] for each vertex v ^ V comes with a partition, and an allowable 
set from the partition. The vertices in V are required to be assigned labels from their respective 
allowable sets. Pre-processing is allowed on all parts of the LCPP instance except for (the choice 
of) the allowable set for each vertex v ^ V. 

The reduction of |AKKV05I from LCPP to MWSPP uses constructions of Label Cover with 
an additional property called smoothness. An instance of LCPP is called ^-smooth if any two 
labels / 7^ z' of 17 S y map to different labels of if € W with probability at least 1 — 3 over the 
choice of neighbors w of v. The smoothness property was introduced in ||Kho02| and has been 
used for several hardness of approximation reductions [ FGRW091 IGRSWIOI IKSl H . The hardness 
factor achieved by the the reduction from LCPP to MWSPP is bounded by 1/^ and 1/s where 
S is the smoothness parameter and s is the soundness of the LCPP instance. The reduction of 
|AKKV05| fails to give a hardness factor better than (logn)^^*^ for MWSPP (even assuming their 
hypothesis) because they use constructions of Label Cover which require size n^^^^^^ to ensure 
(5-smoothness. To get a better hardness factor using this reduction, we require instances of LCPP 
with very good smoothness and soundness simultaneously (relative to the size of the instance). 

Our main technical contribution is to construct instances of HYPER-GRAPH LABEL COVER WITH 
Pre-processing (HLCPP) with very good soundness and smoothness. We achieve this using the 
low degree test |AS03ll^97| , which is guaranteed to work even for very small success probability, 
and combine it with the sum check protocol IILFKN92L which is used to reduce the number of 
queries. The HLCPP problem we consider is a labeling problem similar to LCPP which differs 
from the latter as follows. 



• The vertex set is multi-layered. 

• The constraints are given by hyper-edges rather than edges. A hyper-edge contains sev- 
eral edges and the constraint associated with a hyper-edge is a boolean AND of constraints 
associated to all its edges. 

• The constraints associated to edges are not many-to-one (projection) constraints as in LCPP 
but the more general many-to-many constraints. 



We give an outline of our reduction and the analysis below. 
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Our reduction and analysis. We will start with an instance of F^-Quadratic CONSTRAINT 
Satisfaction Problem (F^-QCSP) for q = 2\ The instance consists of k homogeneous degree 2 
polynomial equations over with n variables, where k = poly(n). Each equation is of the form 
p(zi, . . . ,Zn) = V, and further, depends on at most 3 variables. It can be shown that deciding if 
there is an assignment which satisfies all the equation is NP-hard (see Theorem |2.3| l, even when 
the l.h.s. of these equations (p's) are available for pre-processing. We denote the pre-processing 
version by Fg-QCSPP. Our first step is to boost soundness, i.e., to reduce the fraction of satisfied 
equations by any assignment, while keeping the number of variables small. This is done by com- 
bining an instance of Fg-QCSPP with an appropriate Reed-Muller code over q. We will eventually 

set q = n'°s ' ' This allows us to construct an F^-QCSPP instance where it is hard to distinguish 
between perfectly satisfiable instances and those where any assignment satisfies at most k/q frac- 
tion of the polynomial equations. An important feature of this reduction is that the variable set 
remains the same, so the number of variables is n, number of equations is q and the soundness is 
k/q (which is essentailly same as \/q). This quantitative setting of parameters is crucial for our 
result as the number of variables becomes negligible compared to the number of equations, and 



the reciprocal of the soundness. The details of this reduction appear in Section 2.2 



Each equation can now depend on almost all of the n variables and the next task is to deal with this. 
This is done by reducing checking an assignment for such a system of polynomial equations to the 
task to constructing a PCP which makes 0(log n) queries and has soundness \/q^ for some small 
constant e > 0. This is achieved by combining the low degree test and the sum check protocol and 
is the technical heart of the PCP construction. 



First, the variables are identified with {0, 1}^°^" and embedded as a subcube of F^ where m 



def 



logn. With this mapping, any assignment can be thought of as a function from {0, 1}'" to F,^ and 
can be encoded as a polynomial over F^' of degree at most m. In this setting, if the equation was 
YLi,i€[n] c{i,})ziZj = V = Ea,^e{o,i}'" ^('^z l^)^{^)^iP)' ^' ^ ^e thought of as polynomials of degree 
at most m and 2m respectively. The Arora-Sudan points-vs-lines low degree test can be employed 
to ensure that z corresponds to a small list of degree m polynomials (assignments). This test is 
able to list-decode an assignment with success probability as low asl/q*^ for some small constant 
e > 0. 

Once an assignment for the variables can be decoded, the task of verifying the polynomial equa- 
tions Ea,pe{o,i}'« c(a,/3)z(a)z(/3) = c is equivalent to performing a weighted sum check over the 
sub-cube {0, We use the sum-check protocol of IILFKN9 2 1 to verify that the decoded assign- 
ment satisfies the equations. It can be shown that the soundness of the combined low degree test 
and the sum check protocol is at most 1/qf for a small constant / > 0. 

The result is a PCP with 2m + 2 = 0(log n) layers where the first 2m layers correspond to the sum 
check protocol while the last two layers correspond to the lines and the points table respectively. 
Only the values to be assigned to the first table by the prover will depend on the r.h.s. of the 
Ftj-QCSPP instance. Further, the use of low degree polynomials in encoding the assignments 
implicitly gives our PCP smoothness properties which are used in the final reduction. While the 



preliminaries of the low degree test and the sum check protocol appear in Sections 2.3 and 2.4 



respectively, the PCP construction appears in Section 3.1 
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This view of the PCP naturally leads us to constructing an HLCPP instance which is the starting 
point of the reduction to MWSPP and appears in Section [3^ Finally, the reduction from HLCPP 
to MWSPP is similar to the reduction of [AKKV05| from LCPP to MWSPP. This appears in Sec- 
tion |3] For the reduction to work, we define a notion of smoothness for HLCPP which is similar 
to the one for LCPP and we also need that the hyper-edges of the graph satisfy a uniformity 
condition which is inherited from the PCP construction. 

The main differences in our reduction compared to the reduction of IIAKKV05I are the following: 

• As mentioned earlier, the constraints in the HLCPP graph are many-to-many constraints 
rather than many-to-one constraints. However, the earlier reduction to MWSPP still goes 
through in a relatively straightforward manner. 

• We manage to construct an instance of HLCPP where the smoothness and soundness are 
both at most for some absolute constant / > and the size of the instance is q'-'^'"\ 
Here m = log n where n is the number of variables in the original Fg-QCSPP instance. It is 
not clear that such constructions are possible if we stick to the LCPP problem. The hardness 
factor can be made essentially as large as q^^"' and we set q to be very large compared to 
m to get a good hardness factor relative to the size of the instance. Specifically, we set q = 

2 Preliminaries 

In this section we state the problems we will consider and state basic results which will be useful 
in the construction of our PCP and the reduction. 

2.1 Problem Definitions and Basic Results 

We first define the quadratic CSP problem and its pre-processing version that will be a starting 
point of our reduction. 

Definition 2.1. Fg-QUADRATIC CSP (F,-QCSP): A F^-QCSP instance Q =^ {cy}^^J 
consists of a set of polynomial constraints over variables {zi,Z2, . . .,z„}. Each equation is of the form 

Pj{Zi,Z2,...,Z„) = Cj, 

where pj is a homogeneous polynomial of degree 2, and Cj G F,^. The goal is to find an assignment to the 
variables {zi,Z2, . . . ,z„} each taking a value in F^ which satisfies as many constraints as possible. Let 
OPT{Q) denote the maximum, over assignments to the variables ofQ, of the fraction of equations satisfied. 

Definition 2.2. F,-QuADRATlC CSP WITH PRE-PROCESSING (F^-QCSPP): Given a F<,-QCSP in- 
stance 

Q={{Pi}U{cj}]U) 

over variables {zi,Z2, . . . ,Zn} taking values in Fq, the Fj^-QCSPP problem allows arbitrary pre-processing 
on the polynomials {pj}"L^ before the inputs {cy}"L;j are revealed. 
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The following theorem can be proved in a similar manner as Theorem 4.2 in IIAKKV05I . We in- 



clude a proof in Section A.l 



Theorem 2.3. F<j-QCSPP is NP-complete for all q = T 



Next we define the problem that we prove is hard to approximate and show that it is equivalent 
to the nearest codeword problem with pre-processing. 

Definition 2.4. MINIMUM WEIGHT SOLUTION PROBLEM WITH PRE-PROCESSING (MWSPP): The 

in-put to this problem consists of a set o/ fixed linear forms described by Bf E fI^^ , a set o/ variable linear 

forms Bj, G F2^'^ and a target vector t G The goal is to find a solution x S to the system BfX = t, 
which minimizes the Hamming weight of the vector ByX. We allow arbitrary pre-processing on all parts of 
the input except the vector t. 

Definition 2.5. NEAREST CODEWORD PROBLEM WITH AND WITHOUT PRE-PROCESSING: An in- 
stance 0/ NCP is denoted by {C,t) where C G F2^'^, t G Fj. The goal is to find a solution x G F| 
which minimizes the Hamming distance between Cx and t. In the pre-processing version, NCPP, we allow 
arbitrary pre-processing on all parts of the input except the vector t. 



We note that MWSP is actually same as the NCP problem in disguise, though we find it conve- 
nient to think of it as a separate problem. To see the equivalence with NCP, let Xq be a fixed vector 

such that BfXo = t, let w = BjjXq and consider the code C =^ {B^x \ x s.t. BfX = 0}. Then 

min 3{w,Bjjx) = min S{B-oXo,B-ox) = min wt{Byx). 

x:BfX=0 x:Bf{x+Xg)=t x:BfX=t 

Here S{-,-) measures the Hamming distance and wt{-) denotes the Hamming weight of a string. 

Finally we note that proving the hardness for NCPP implies the hardness for CVPP 

Theorem 2.6. j|FMQ4f Let 1 < p < 00. 7/ NCPP (MWSPP) is hard to approximate to factor f then 
CVPP, under the Ip norm, is hard to approximate to factor f^^f. 



2.2 Boosting Soundness through Codes 

The following lemma shows how to boost soundness of the F^-QCSPP instance although it in- 
creases the number of variables per equation. The proof of this lemma employs Reed-Muller codes 



and appears in Section A.2 



Lemma 2.7. Let Q be an instance o/F^-QCSPP over n variables and k = poly{n) equations, for any 
q = 2''. There is an instance P o/F^-QCSPP over the same set of variables and q equations such that: 

• IfOPT{Q) = 1 then OPT{P) = 1 and 

• ifOPT{Q) < 1 then OPT{P) < k/q. 

In our reduction q would be n'°8 ' ' " and, hence, q ^ k. 
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2.3 Low Degree Test 



Now we move on to developing tools necessary for keeping the number of queries in our PCP 
small. The first step in this is the Low Degree Test. In this section we recall the basics, the test and 
state the Arora-Sudan theorem which will be used. 

An affine line in is parametrized by {a, b) G (Fq'\{0}) x F^" such that La,b == {ax + b : x 
Sometimes, we will drop the subscript if it is clear from the context. In what follows, if it helps, 

def def 

one can think of m = log n and d = m as will be the case in our reduction. For a polynomial 

^ : F^' 1-^ F(j of degree d and a line L =^ L^^hf let be the restriction of g defined as gliix) == 
g{ax + b) for x G F^. For two polynomials g, h we denote g = hif they are identical. 

Definition 2.8 (Low Degree Test). The Low Degree Test takes as input the value table of a function 
f : FJ^' I— > Fq and for every (affine) line L ofF^, the coefficients of a degree d -polynomial gi. 

The goal is to check that f is a degree d polynomial. The intention is that gi is the restriction off to the line 
L. 

The test proceeds as follows: 

1. Pick a random point x S F^ and a random line L containing x. 

2. Test that gi{x) = f{x). 

The following theorem can be inferred from Theorem 1 and Lemma 14 in ||AS03| . 

Theorem 2.9 (Soundness of Low Degree Test). There are absolute constants < Ci, C2 < 1 such that 
for 5 =^ 1/ q^"^, I '= q'^^, if f '■ F^ i-^ Fg passes the Low Degree Test (Definition 
then there are I degree d polynomials f^,f^, ...,/' such that : 



2.81 with probability p, 



Pr 

L,x 



gi^{x)=f{x) & aye {1,2 /} : >v-5. 



In words, whenever the low degree test accepts, except with probability 5, the test picks a line L such that 
gi corresponds to the restriction of one of the polynomials f^,f^, . . . ,f^ to L. 

We assume here that d <^ q (in our application, d < 0(log q)). 
2.4 Sum Check Protocol 

We will also need the sum check protocol for our PCP. We start with some definition, state the 
test and the main theorem establishing the soundness of it. Think of M = 2m and, hence, F^ = 
Fg" X Fg" in the discussion below. Also one can think of cf = 4m. We first need a notion of partial 
sums of polynomials. 
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Definition 2.10 (Partial Sums). Let g : ^W^he a degree d polynomial. For every < ; < M — 1 
and every ai, a2, . . ., fly G Fg we define the partial sum gai,a2,...,aj as a polynomial from as follows: 

gai,a2,...,aj{z) =^ g(fll, fl2, . . . , fly, Z/ • • • ' ^m)- 

V2'->mG{0,1} 

When i = Owe denote the polynomial as g^. When j = M — 1, the summation is just g{ai, . . . , a^-i, z). 
Note that all the polynomials so defined are of degree at most d. 

Definition 2.11 (Sum Check Protocol). The Sum Check Protocol takes as input a value table for a 
fiinction g : F^ i— > F^, a target sum c G Fg and for every < ; < M — 1 and every fli,fl2, . . . ,fly G F^, 
the coefficients of a degree d polynomial pai,a2,...,aj- The goal is to check whether ^ g{z) = c. The 

intention is that g is a degree d polynomial and pai,a2,...,aj correspond to partial sums of g as in Definition 

2.10 The test proceeds by picking x =^ (fli,fl2, . . .,flM) G F^ uniformly at random and accepts if and 
only if all of the following tests pass. 

J- P0(O) + p0(l) =c. 

2. For all 1 < ; < M - 1, Pa^,a2,...,aj_A'^j) = VaiAi.-Mji'^) + Pfli,fl2,...,«/(1)- 

3- P«l,«2 «M-i(«m) =^(^)- 



The following theorem will be used in our reduction. The proof appears in Section A.3 
Theorem 2.12 (Soundness of Sum Check Protocol). HLFKN921 Let g^,g^, . . . ,g^ : be de- 



gree d polynomials and g : F^ i— > Fg an arbitrary function. Suppose for every !<;</, ^ g'{z) 7^ 

2G{0,1}*^ 

c. For X G F^, let V{x) be the event that the Sum Check Protocol (Definition 2.11 1 accepts on inputs g, c 
and Pai,a2,...,aj- Here x is the choice of randomness in the Sum Check Protocol. 



Then 



Pr 



P{x) & 3;G {1,...,/} : g{x)=g'{x) <Mdl/q 



In words, the probability that the Sum Check Protocol accepts when g is consistent with one ofg^,g^, . . . ,g' 
is at most Mdl/q where g^,g^, - ■ ■ ,g^ fl?'^ degree d polynomials whose sum is not the required value. 
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3 The Reduction 



The following is the main theorem about the reduction and implies Theorem 1.1 via Theorem |2.6[ 

Theorem 3.1. Unless NP C DTI ME {2^°^°^'^'^ MWSPP is hard to approximate to factor 2ios'"'"/or 
an arbitrary small constant £ > 0. 

Towards the proof of this theorem, we will give a reduction from F^j-QCSPP to MWSPP. The 
reduction proceeds in three steps: 



• Reduction from F^-QCSPP to a PCP with low query complexity (Section 3.1 1. 



Construction of an HLCPP instance from the PCP (Section |3.2| |. 
Reduction from HLCPP to MWSPP (Section [331>. 



Finally we will complete the proof in Section 3.4 where the choice of parameters is made. 



3.1 Smooth PCP with Low Query Complexity 



Note that the F^-QCSPP instance given by Lemma 2.7 has almost all the variables appearing in 
every equation. For the reduction to MWSPP we require a PCP where every query depends on a 
few variables. We will also crucially need a smoothness property from the PCP similar to the one 
described for LCPP in Section [lT| To this end, we use the Low Degree Test of l|AS03| and the Sum 
Check Protocol of IILFKN92I , similarly as in IIKP06I . 

3.1.1 Describing the PCP 

Let P be the instance of F^^-QCSPP given by Lemma Zzjover variables {zi, . . . ,z„}. Let m =^ log n. 
Here we assume that n is a power of 2. We think of the variables of P as being embedded into 
{0,1}"' within F^". Henceforth, we will refer to the variables by their corresponding points in 
{0,1}"'. Thus, an assignment A : {0,1}"' ^ F^ to the variables can be extended to a degree m 
polynomial / : F^' i— > F^ such that / is consistent with A on {0, 1}"'. 

Let the equations be £i, . . . , Eq where each equation is of the form 

Ei = Pi{zi,...,z„) =Ci= Ci{s,t)zsZt = Ci= Ci{oi,^)zocZii = Q. 

s,te[n] a,^e{Q,l}"' 

For an assignment A to {zcc} kg {0,1}'"' /a denote the degree m polynomial encoding A. Now, 
checking whether an equation £, G P is satisfied by A amounts to checking 

c,(«,/3)/^(«)/a(/5) = Q. 

a,/5G{04}"' 

Note that c/(a,/3) can be thought of as a degree 2m polynomial over F^"" and is a part of the pre- 
processing. 
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The PCP we will construct expects the following tables: 



1. Points Table: The value of a function / : F^" i— ?► Fg at every point in F^. The intention is that 
/ is a degree m pol}momial which encodes a satisfying assignment to P within {0, 1}'", i.e., 
for a satisfying assignment A, f{oi) = fAi.^) for all a G {0, 1}'". The size of this table is q"^. 

2. Lines Table: The coefficients of a degree m polynomial gi for every (affine) line L of F^'. The 
intention is that gi^ is the restriction of / on L. The size of this table is at most (j^"^ ■ (m + 1). 

3. Partial Sums Table: For every equation £, G P, every < < 2m — 1 and every ai, a2,..., aj S 
F(j, the coefficients of a degree 4m polynomial Pi,ai,a2,...,aj- The intention is that Pi,ai,a2,...,aj 



correspond to partial sums of (Definition 2.10 1 where gi{(x.,^) =^ Cj{a., j5)f{a)f{l5) where 



a =^ (fli, . . .,am) and fi =^ (flm+i/ • • • / fl2m)- Note that gi has degree at most 4m and the size of 
the ;-th partial sum table is q ■ ■ {^m + 1). 

PCP Test: 

Pick equation E, G P uniformly at random. Pick oc =^ (fli, a2,...,am) G F^', j6 =^ (flm+i/ • • • / 'J2m) £ 
Fg" uniformly at random. Let L be the line passing through a and jS. Read the following values 
from the corresponding tables: 

• f{cc),f{^) G Fg from the Points table. 

• The poljmomial gi from the Lines table. 

• The polynomials Pi,ai,a2,...,aj from the Partial Sums table for every < ; < 2m — 1. 

Acceptance Criteria for the Test: 

Accept if and only if all of the following tests pass. 

1. ^l(«)=/W and^i.(/3)=/(/3). 

2. p,-,0(O) + p,,0(l) = Q. 

3. For all 1 < ; < 2m - 1, p^i,a2 = P/>i,«2 + Pi,«i,«2 

4- P!>i,«2 «2.,-i(«2m) =Ci{a,^)f{a)f{^). 

Note that we allow arbitrary pre-processing on everything except {C;}j_-^. 
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3.1.2 Completeness and Soundness of the PCP 

We prove the following theorem here: 

Theorem 3.2 (Low Degree and Sum Check). Let P bea F^-QCSPP instance. Then 

1. IfOPT{P) = 1, then the PCP Test succeeds with probability 1. 

2. IfOPT{P) < k/q and k < q'^ for a small enough c, then the test succeeds above with probability at 
most 1/q'^ for some constant e > 0. 

The proof of the theorem follows from the following two lemmas. 

Lemma 3.3 (Completeness). If there exists an assignment A to {zi, . . .,z„} such that OPT{P) = 1, 
i.e., Ei,...,Eq are all satisfied, then there is an assignment to all the tables such that the test accepts with 
probability 1. 



Proof We let / = /a, gi = /a | l for all L, and for all z G [q\,Q < j <2m — 1, and fli, . . . , fly G F^, 

Pi,ai,...,aj'= hi{ai,...,aj,Z,bj^2,---,b2m), 

bj+2 fo2mG{0,l} 

where hi{x,y) is the pol5momial of degree at most 4/n representing Cj{x,y)fA{x)f/^{y). It is clear 
that the test succeeds with probability 1. □ 



Lemma 3.4 (Soundness). There is an absolute constant e > such that if OPT (P) < k/q and k < q'^ 
for a small enough c, then the PCP described above has soundness at most l/q'^. 



Proof. We first observe that Step [T] of the protocol is equivalent to running a low degree test (Def- 
inition |2.8| on L and a with input tables gi and / respectively. This is because the choice of j6 is 
independent of oc and uniform in F^. Let < Ci,C2 < 1 be the constants given by Theorem 

Let f^,f'^, ...,/' be the list of / '= q'^^ polynomials promised by Theorem 



2.9 



2.9 



The following events can happen on a run of the PCP: 



1. The low degree test between L and a fails. That is, gL{oi) 7^ /(*)• In this case, the PCP does 
not accept. 

2. giil^) 7^ /(/^)- Iri this case, the PCP does not accept. 

3. The low degree test accepts (5^l(*) = /(^)) but there is no 1 < / < / such that gi = By 



theorem 



2.9 



def 

this happens with probability at most S = 1/q'^'^. 
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If none of the events listed above occur, then we have that gi is the restriction of fj for some 
1 < i < I. Also, since Step [l] accepts, we must have f{cc) = /^(a) and /(j6) = /•'(j6). 

Let Ei be an equation not satisfied by any f) for 1 <J< I- Note that Steps[2||3]and[4]are equivalent 

def 



2.11) on gi : F^"' ^ defined as ^,(a,(6) 



to running the Sum Check Protocol (Definition 

Ci(a, ^)f{oi)f{^). gi has degree at most 4m. Let ^) =^ Ci(a, ^)fi{a)f'{^). Finally for x G F^"', 
let 'Pi{x) be the event that the Sum Check Protocol accepts. 



Applying Theorem 2.12 



Pr 



Vi{x) & 37G {1,...,/} : gi{x)=g'.{x) <[2m)dl/q 



Thus, when none of the events in the list occur, the PCP accepts with probability at most (2m) ■ 
(4m) -1/ q conditioned on choosing Note that every may satisfy at most k of the q equations. 

Thus, the total probability that the PCP accepts is at most 5 + {1 — Ik/ q) ■ 0{m^l/q) and it is easy 
to check that by our choice of parameters this is smaller than l/q"^ for some absolute constant 
e > 0. □ 



3.2 PCP as Hyper-graph Label Cover 

It will be useful to think of the PCP as a graph labeling problem. The labeling problem we consider 
is similar to the well-known LABEL COVER problem except for the following differences: 



• The graph is not bipartite but consists of several layers, with edges between consecutive 
layers. In addition, there are hyper-edges which consist of several edges. The goal is to 
find a labeling which satisfies the maximum fraction of hyper-edges, where the constraint 
corresponding to a hyper-edge is the logical AND of the constraint corresponding to each of 
its edges. 

• The constraints corresponding to edges are not projection constraints as in the case of Label 
Cover, but the more general many-to-many constraints. For an edge e = {u,v), a many-to- 
many constraint is described by an ordered partition of the label set of u and the label set of 
V such that the constraint is satisfied if and only if both u and v receive labels from matching 
partitions. Formally, let e = {u,v) be an edge and [Ru], [Rv] be the label sets of vertices u 
and V. Then the many-to-many constraint is described by a pair of maps Tie '■ [Ru] ^ [Re], 
(Te : [Rv] ^ [Re] where [Re] is a label set associated to e. A label / to u and a label /' to v is 
said to satisfy edge e if TZe{l) = (Te{l'). 



We now formally describe the Hyper-GRAPH LABEL COVER problem. While the term Hyper- 
GRAPH Label Cover can be potentially used for a more general class of problems, in this paper 
we restrict our attention to a very special class of graphs useful for our reduction. 
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Definition 3.5. HYPER-GRAPH LABEL COVER PROBLEM 

An instance G{V, E, £, [Rq], [Ri], [Rim+i], {'^e, (^ejeeE, {Sv, S^}^f=Co) o/Hyper-graph Label Cover 
consists of: 

def 

• A graph G{V,E). The vertices are partitioned into 2m + 2 disjoint layers, V = CqLS CiLS ■ ■ ■ LI 
^2m+i- The edges in E are always between a vertex in Ci and a vertex in Ci^ifor some i. 

• Label sets [Ri]for vertices in layer Ci. Furthermore, for every vertex v G Cq, there is a partition 
of [Rq] and an allowable set of labels Sy G S^. 

• A many-to-many constraint for every edge. Let e = {u,v) be an edge where u S v G The 
instance contains projections tZc : [Ri] ^ [Re], '■ [^i+i] ^ [Re]- ^ labeling {1,1') to {u,v) is said 
to satisfy e ifTTg{l) = ae{l'). 

• A set of hyper-edges £. Every hyper-edge consists of one vertex from the first 2m + 1 layers and two 
vertices from the last layer, such that there is an edge between any pair of vertices in adjacent layers. 
A labeling to the graph satisfies a hyper-edge if all the edges contained in it are satisfied. 

The goal is to find a labeling to the vertices which satisfies the maximum fraction of hyper-edges. Vertices 
in Ci are required to receive a label from [Ri]. Furthermore, vertices in Cq are required to receive labels from 
their allowable set. 

We also define a pre-processing version of the Hyper-graph Label Cover Problem similar to 
the LCPP problem of [|AKKV05J . 

Definition 3.6. HYPER-GRAPH LABEL COVER PROBLEM WITH PRE-PROCESSING (HLCPP) 

Given an instance G{V,E,£, [Rq], [R-^],. . . , [Rim+i], {'^e,(^e}eGE> {Sy, Syjy^Co) o/ Hyper-graph La- 
bel Cover, the HLCPP problem allows arbitrary pre-processing on all parts of the input except the 
allowable sets {Sy}y^c^^. 

We will need a notion of smoothness similar to the definition of SMOOTH Label Cover. 
Definition 3.7. (Smoothness) 

We say that an HLCPP instance G{V, E,£, [Rq], [Ri], . . . , [R2m+i], {^e, CTe} eeE> {'Sy,Sy}yf=Co) is S-smooth 
if for every < i < 2m, u G Ci, I E [Ri] we have 

Pr [nS) = Ml')] < 5 

e—[u,v)£E 

Here v G >C;+i and [ne,(Te) is the many-to-many constraint associated to e. 

Lastly, we will need that the hyper-edges of the graph are regular in a certain sense. 
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Definition 3.8. (Uniformity) 



Let G{V,E,S,[Ro],[Ri], . . . ,[R2m+i]f {'^e,'^e}eGE, {3v,Sv}vgCo) be uu HLCPP instance. We say that 
the instance is uniform if the following conditions are satisfied: 

1. For every < / < 2m + 1, every vertex in layer Ci has the same number of hyper-edges passing 
through it. 

2. For every < / < 2m, the following two distributions are equivalent: 

• Select an edge between a vertex in layer Ci and a vertex in layer Ci^i uniformly at random. 

• Select a hyper-edge T-L E £ uniformly at random and then select an edge from T-L between a 
vertex in layer Ci and a vertex in layer Ci^\ uniformly at random. Recall that a hyper-edge 
contains exactly one edge between layers Ci and Ci^\ for < / < 2m — 1 and two edges 
between layers Cim and Cim+i- 



We next briefly describe how the PCP described in Section 3.1 can be thought of as an HLCPP 
instance. 

• Layers C2m and C2m+i' These are the Lines table and the Points table respectively. There is 
a vertex L in Cim corresponding to every line in F^'. There is a label to L for every possible 
univariate degree m polynomial over Fg. Hence, the number of vertices in C2m is at most 

and the size of the label set for each vertex is R2m = q"'^^. There is a vertex u in C2m+i 
corresponding to every oc G F^". There is a label a to a for every possible a G F^j. Hence, the 
size of the vertex set in £2m+i is 'j'" and size of the label set is -Rim+i = ^• 

There is an edge between L and oc if the point a belongs to the line L. The constraint between 
the two vertices corresponds to Step [l] of the PCP. 

• Layers Co through C2m- These are the Partial Sums table and the Lines table respectively. For 
1 < 7 < 2m — 1, there is a vertex corresponding to (z, fli, a2,..., aj) in Cj for every equation 
Ei G P and every fli,fl2/ ■ ■ ■ ,aj G F^^. There is a label to {i,ai,a2, . . . ,aj) for every possible 
univariate degree 4m polynomial over Fg. For / = 0, there is a vertex (z,0) corresponding to 
every equation E,- G P. There is a label to (z, 0) for every univariate degree 4m polynomial 
over ¥q. Furthermore, there is a partition of the label set into q parts, indexed by F^ as 
follows: 

Pa == {all polynomials p of degree at most 4m over F^ such that p(0) + p(l) = a}. 

The allowable set of labels for every vertex corresponds to the part that satisfies Step |2] of 
the PCP. Thus, for < 7 < 2m — 1, the size of Cj is q ■ q^ while the size the label set is 

Ro = Ri = ■ ■ ■ = Rlm-l = ^''"+'. 

For 1 < < 2m — 1, there is an edge between a vertex (z, ai, a2,..., fly-i ) in Cj^i and a vertex 
(/', flp fl2/ • • • / ^'j) in Cj if i = i' and a^^ = a'^. for 1 < fc < ; — 1. The corresponding constraints 
are given by Step |3] of the PCP 
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There is an edge between vertex {i, Ui, a2,..., aim-i) in C2m-i and vertex L in C2m if there is 

an Urn S such that for a =^ [ui, . . . j6 == {cim+i, ■ ■ ■ ,<^im), the line L passes through 
a and /5. The corresponding constraints are given by Step |4] of the PCP. Note that Step |4] 
requires the values of the function at points a and j6 both of which lie on line L. Thus, a label 
to L specifies the values of / at a and /3. 

It can be checked that the constraints so defined are many-to-many constraints.^ Note that we 
allow pre-processing on everything except the allowable set of labels for vertices in layer Cq as 
required. 

It can be seen that the HLCPP instance so constructed is 4m / (j-smooth, since no two distinct 
degree 4m polynomials over Wq can agree on more than 4m/ q fraction of points in F,^. 

We record this identification of the PCP with an HLCPP instance as the following theorem. 

Theorem 3.9. There is a reduction from an F^j-QCSPP instance P over n variables to an HLCPP instance 
L = G{V,E,£, [Rq], [Ri\, . . . ,[Rim+i], {Tie,o-e}e<^E, {Sv,S-o}v€Co) where m = logn, such that 

1. IfOPT{P) = \, then OPT{L) = 1. 

2. IfOPT{P) < k/q and k < q'^ for a small enough c, then OPT{L) < l/q'^ for some constant e > 0. 
Furthermore, the HLCPP instance L is {4m/ q)-smooth (Definition \3.7\ and uniform (Definition \3.8\ . 

3.3 Reduction to MWSPP 

The reduction from HLCPP to MWSPP is very similar to the reduction from LCPP to MWSPP 
described in IIAKKV05II . 

Let G{V, E, £, [Rq], [Ri], [Rim+i], {tTc, c^JeeE/ {Sv, S-o}y^Co) instance of HLCPP. For each 

vertex v ^ V and each label / to v we have a variable Wj, /. We now describe the fixed linear forms 
Bf of the MWSPP instance. Below, denotes addition over F2. 

Vertex constraints: 

1. VI < 7 < 2m + 1, Vz; G Cj, ®i^[r.] zu^j = 1. 

2. yv G Co, VS G 5^, 

^ Wj, / = 1 if S = Si, and otherwise. (3.1) 

/GS 

Notice that only the r.h.s. depends on the input (which is Si,). 

^Actually, the constraint between vertices in layers £2m-i and £2™ is not many-to-many when c, (a, /5) = but this 
happens for at most 2m/ q fraction of vertices for every equation hence we can afford to ignore these vertices and any 
hyper-edges containing them. 
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Edge constraints: 



Let e = {u,v) be an edge where u G Li, v G £,+1. Let ZTg : [R,] [Kg], c^g : [R;+i] [Kg] be the 
projections describing the many-to-many constraint associated to e. For every element a G [Kg] 
we add the following fixed linear form: 

a^.,;= w-oy (3.2) 

/G[R;]:7r,(;)=H ;G[R;+i]:£7,(/)=fl 

We now describe the variable forms Bj, for the MWSPP instance. Let be the number of vertices 

in layer Ly Let q =^ 11^=0^^ For every layer L^, < j < 2m + 1, every vertex v G Cj and every 

label / to V, we have the variable form ^ repeated q/ qj times. This completes the description of 
the MWSPP instance. It remains to prove the completeness and the soundness of this reduction 
which we do next. 

3.3.1 Soundness of the MWSPP instance 

Here we show that the MWSPP instance constructed has a large gap. 

Theorem 3.10 (Reduction from F^-QCSPP to MWSPP). Let h be such that l/{m^hf'" > 1/q'for 
large enough m and for some fixed small constant e. 



Completeness: IfP is satisfiable then the MWSPP instance constructed in Section 3.3 has a solu- 
tion of weight at most {2m + 2) ■ q. 

Soundness: IfP is such that OPT{P) < k/q then the MWSPP instance constructed in Section 



3.3 has no solution of weight less than h • {2m + 2) ■ q. 



Proof. Completeness. If the F^^-QCSPP instance P is satisfiable then the HLCPP instance has a 
labeling which satisfies all constraints (Theorem 3.9 1. For an MWSPP variable ro^ j corresponding 



to vertex v and label / to v, we let w^^^ = lifv was assigned the label / and otherwise. It is easy 
to see that this satisfies all fixed linear forms and gives a solution of weight 

2m+l 2m+l 
;=1 veCj j=l 



Soundness. In this case we are given that OPT{P) <k/q and, hence by Theorem 3.9 any labeling 
to the HLCPP instance satisfies at most 1/q'^ fraction of the hyper-edges for some small constant 
e. The number of hyper-edges in the instance are \[q] x F'^ x F^"| = q^'"^^. Suppose there is a 
solution to the MWSPP instance of weight h ■ {2m -\-2) ■ q which satisfies all fixed linear forms. 
We will give a (randomized) labeling to the HLCPP instance which in expectation satisfies more 
than 1/ {m'^h)^"' > \l q^ fraction of the hyper-edges, contradicting Theorem 3.9 
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Let {Wjj i} be a solution of weight at most h ■ {2m + 2) ■ q. Call a label I for v nonzero if w^j = 1. 
(Note that our variables are allowed only 0/1 values.) We know from our assumption that 

2m+l 

Y2^v,l ■ = h ■ {2m + 2)-q. 

j=0 v,l 

Let n'y denote the number of nonzero variables for the vertex v in the j-th layer. Then the above 
can be written as 

2m +1 

Y:nUqj = h.{2m + 2). 

7=0 V 

Hence, for all J^j, n'jj/qj < h ■ {2m + 2). Hence by Markov's Inequality, for every the fraction of 

V for which n{, > m^h is atmost h ■ {2m + 2)/{m^ ■ h) < 3/m^ for large enough m. We call a label 
i for a vertex v non-zero if Wj,^i = 1. We remove all vertices from the graph which have more than 

r'^h-m^ non-zero labels. This removes at most 3/m^ fraction of vertices from each layer. Next, 
we remove all hyper-edges containing any vertex removed in this step. To bound this number 
notice that our graph has this property that number of hy per-e dges per vertex of layer j is at most 
^2m+i Jtemnlof the uniformity property: Definition 



3.8 1. Since number of vertices removed 



per layer is at most 3qj/ m^, the number of hyper-edges removed in layer ; is at most 3q^"'^^ /qj. 
Hence, the number of hyper-edges removed overall is at most 3 ■ {2m + 2)q^'^^^ /m^ <9/m- q^"^^^ 
for large enough m. Thus, the total fraction of hyper-edges removed is at most 9/m which is 
negligible. Thus, we have an HLCPP instance where every vertex has at most r non-zero labels 
and we wish to satisfy more than l/q'^ fraction of the queries. 

Labeling. We define a randomized labeling for the HLCPP instance: randomly assign a nonzero 
label independently for each vertex. This is possible as the sum (over F2) of the variables corre- 
sponding to each z; is 1 and hence not all variables for a vertex can be 0. 

The next claim shows that the expected fraction of hyper-edges satisfied is at least r^^'" = {h ■ 
jj^3-j-3))( -^vj-iicj-i is larger than 1/q'^ hy our assumption. 

Claim 3.11. Conditioned on the hyper-edge not being removed, the expected fraction of hyper-edges satisfied 
by the randomized labeling defined above is at least r^^"' where r = hm^. 



Proof of Claim. We first remove all edges e in the graph for which some pair of non-zero labels map 
to the same label via the constraint associated to e. Formally, let e = (w, v) be an edge, I ^ I'he two 
non-zero labels for u and {rie, ae) be the maps describing the many-to-many constraint associated 



to e. We remove the edge e if ne{l) = Tie{l'). Since the instance is 4wj /^j-smooth (Definition 3.7 1, 
taking a union bound over all pairs of non-zero labels implies that the fraction of edges removed 
in the graph is at most Amr^/q. 

Next, we remove all hyper-edges containing any edge removed in the previous step. Using Item|2] 



of the uniformity property (Definition 3.8 1 and a union bound, it can be seen that the total fraction 
of hyper-edges removed is at most 3m ■ 4mr^/ q < 12m^r^/ q, which is negligible by our choice of 
parameters. Thus, we have an HLCPP instance where every vertex has at most r non-zero labels 
and the many-to-many constraint maps all non-zero labels to distinct labels. 
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For a hyper-edge to be satisfied, its vertex in should receive a label from allowable set. By 
Equation ( |3.1[ ), there is at least one non-zero label from this set. Thus, with probability at least 1 /r, 
we pick an allowed label for a hyper-edge. 

For < / < Im, we will show that if we have assigned label / to vertex u G L^, then the probability 
of assigning a consistent label to any of its neighbors in >Cy+i is at least 1/r. By a consistent label 
we mean one which satisfies the constraint on the edge. 



Suppose we have picked a label / for a vertex u G We claim that the left side of Equation 3.2 
is 1, since there is no non-zero label /' for u such that UeiX) = ne{l'). This means that the r.h.s. is 
also 1 (since the fixed linear forms are satisfied). Hence there must be a non-zero label for v which 
satisfies the constraint associated with the edge e = (w, v), and this label is assigned to v with 
probability at least 1/r (over the random choice of a labeling). Hence, the constraint between u 
and V is satisfied with probability at least 1/r. 

This shows that for a fixed hyper-edge, the probability (over the randomized labeling) it is satisfied 
is at least r^(2'"+3) which is the number of vertices in the hyper-edge. Thus, the expected fraction 
of hyper-edges satisfied is at least r^(2'"+3) > ^.-Sm -pj^is completes the proof of the claim. □ 

Noticing that by our choice of parameters < r^^"', we obtain a contradiction. Hence, this 
completes the soundness proof and, hence, the theorem. □ 



3.4 Choice of Parameters and the Proof of Main Theorem 

Proof of Theorem [3T| Let Q be the F^j-QCSPP instance given by Theorem 2.3 over n variables and 



3.1 



k = poly{n) equations. We apply Lemma 2.7 to get an F^-QCSPP instance over n variables and q 

equations where q =^ 2('°S")*''^''. vVe then apply the series of reductions described in Sections 
HiandlU 

Let N be the size of the MWSPP instance constructed in Section [33] It can be checked that N < 
qWOm^ where m '= log n for large enough m. Hence, N < q^°^ " for large enough n. We need m and 
h to satisfy 

i/,.3m = i/,.3iogn = i/(-^3;,)3m > xhls Is true If logk < log'j/iog^n and logq » log n log log n and n 
is let to be large enough. 

We set h =^ q^°^ ". For a large enough positive integer D = Ve, let q be such that \ogq =^ log^ n. 
Hence, log q ^ log n log log n. Moreover log N < log n and log h = log n. This implies that 

log^-'N = log(°+2)(^-') n < log^-^n = \ogh 

Finally, N < q^°S " = 2^°S Summarizing, our reduction is deterministic, the hardness factor is 
2iogi-^ N tgi,gg tijj^g 2i°8°"^'' " and, hence, holds under the hypothesis NP ^ DTIME{n^°&°'''''^ 

□ 
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A Omitted Proofs 



A.1 F^-QCSPP is NP-complete 

Theorem A.I. ]F<,-QCSPP is NP-complete for all q = T. 

Proof. We reduce 3SAT to F^-QCSPP . For this proof, it is convenient to view the input for 3SAT 
in the following form: the input is {V,E), where E G {0,1}'"^" and corresponds to a 3SAT 
formula ^ = Ci A • • • A with variables {xi, . . . ,x„}. Each row of V corresponds to a clause C; 
and Vjj is 1 if and only if Xj appears in C,-. Thus, each row of V has exactly three I's. The entry E,y 
is 1 if and only if the variable Xj appears as a negated literal in C,. 

Since 3SAT is in NP, for every n, there is a circuit C„ which takes as input (V, E) and an assignment 
a G {0, 1}", such that, C„ (a, V, E) = 1 if a is a satisfying assignment for (p, and otherwise. 

Now we present the reduction, which is exactly the same as in Theorem 4.2 of PAKKV05I . except 
that we work over rather than F2. Let {V, E) be the input corresponding to a 3SAT instance (p. 
We may assume that every gate in C„ has fan-in 2 and fan-out 1. For every bit in the input {a, V,E) 
to Cn, there is a variable in F^: x, is supposed to be assigned the f-th bit of a, Xjj is supposed to be 
assigned Vjj, while x-^ is supposed to be assigned E,-,-. 

Associated to the output of the f-th internal gate^ in C„ is a variable z, . Further, let 1/0 be the variable 
corresponding to the output gate which outputs whether an assignment a satisfies (p or not. 

The computation of any gate can be written as a quadratic polynomial (over F2) in its inputs (call 
these z,z') and output (call it z"): z" = zz! for an AND gate, z" = 1 + (1 + z)(l + z!) for an OR 
gate, and z" = 1 + z for a NOT gate. 

Note that F2 is a sub-field of F^ since c\ = T va power of 2. Thus, each element of F^ can be 
naturally identified with a vector in Fj such that addition in F^ corresponds to vector addition and 
multiplication in F(j corresponds to taking dot products. In any such representation, the element 
G F(j corresponds to the all O's vector while the element 1 G F(j corresponds to the all I's vector. 
The crucial observation is that the polynomials for the AND, OR and NOT gates described above 
act as co-ordinate wise AND, OR and NOT gates when the inputs and the output are elements of 
F2 (Fq), when all computation is done over F^. 

We write such an equation for every gate in C„. Each equation is of degree at-most 2 and has at- 
most 3 variables. Note that every such equation depends only on the description of C„. Finally, 
we add the additional set of equations 1/0 = 1/ ^i] = ^i] arid x\- = E,-,-. Hence, we get a F^^-QCSPP 
instance over the set of variables 

{xi : / G [n]} U {Xy : i G [m],; G [n]} U {4 : i G \m\,] G [n]} U {z, : 1 < / < size(C„)} U {yo}- 



'A gate is said to be internal if its output is not an output of the circuit. 
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Notice that C„ can be generated by a pol}momial time algorithm which is given as input 1". Hence, 
this reduction is a polynomial time reduction. 

We claim that this quadratic system has a solution (over F^) if and only if (p has a satisfying so- 
lution. The corresponding claim when all variables take values in F2 follows by construction. 
Now note that if there is a solution over F^ then taking the last co-ordinate of the variables (when 
viewed as vectors over F2) is a valid solution over F2, since all gates act co-ordinate wise. 

The reduction described above gives constraints which are of degree at most 2, but not homo- 
geneous. This is easy to fix by introducing an auxiliary variable Zq and adding the constraint 
zqZq = 1. We then multiply all terms of degree less than 2 by Zq. 

This completes the proof of the lemma. 

□ 



A.2 Boosting Soundness through Codes 

We first need some basic definitions. 

Definition A.2. Codes: A matrix C G F^^*^ is said to be a generator of the linear code {Cx : x S F^} 
with distance 1 — 3 if for any x 7^ 1/ G F^, C{x) and C{y) agree on at most 5m co-ordinates. 

Fact A.3 (Reed-Muller Codes). For any q, let F^ be the field over q elements. There is a family of linear 

codes with generator matrix Q G F^j^*^ with distance 1 — k/q. These are the so called Reed Muller codes 
over Fg, where the message is thought of as the coefficients of a degree k polynomial and the codeword the 
evaluation of this polynomial on all the points in F^. 

Lemma A.4. Let Q be an instance o/F^^-QCSPP over n variables and k = poly{n) equations, for any 
q = 2''. There is an instance P o/F^-QCSPP over the same set of variables and q equations such that: 

• IfOPT{Q) = 1 then OPT{P) = 1 and 

• ifOPT{Q) < 1 then OPT{P) < k/q. 



Proof. Let R G F^j^*^ be the Reed-Muller code matrix as in Fact A.3 Let p\,...,p^ be the equations 



of Q and let r G F^ be a row of R. We add the constraint r^p, to P which is a F^^-linear 
combination of the equations in Q. Thus, P has q equations. 

It is clear that any satisfying assignment to all equations of Q is also a satisfying assignment for all 
equations of P. This shows that if OPr(Q) = 1 then OPr(P) = 1. 



On the other hand, suppose OPT[Q) < 1 and fix any assignment A to the variables of Q. An equa- 

=51 



tione, G Q is of the form p,(zi, . . .,z„) = Cj. Letv^ G F^ be defined as =^ p,(A(zi),. . .,A{z„)) 
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Cj. Since OPT{Q) < l,v^ ^ 0*^. Thus, by the code property we have that C]^ ■ is zero in at most k 
co-ordinates. Notice that Ck ■ has a in a co-ordinate if and only if the corresponding equation 
in P is satisfied by A. Since this holds for every assignment A, the theorem follows. 

□ 



A.3 Sum Check Protocol 

Theorem A.5 (Soundness of Sum Check Protocol). l\LFm921 Let g^.f g' : be degree 

d polynomials and g : F^ Fg an arbitrary function. Suppose for every !<;'</, ^ 7^ c. 

2G{0,1}*^ 



For X G F^, let V{x) be the event that the Sum Check Protocol (Definition 2.11 1 accepts on inputs g, c 
and Pai,a2,...,aj- Here x is the choice of randomness in the Sum Check Protocol. 



Then 



Pr 



V{x) & 3;G {1,...,/} : g{x)=gi{x) <Mdl/q 



In words, the probability that the Sum Check Protocol accepts when g is consistent with one ofg^,g^, . . . ,g' 
is at most Mdl/q where g^,g^, ■ ■ ■ , g^ are degree d polynomials whose sum is not the required value. 



Proof. We will prove the theorem by induction on M. 
Base Case: M=l We consider two cases: 

1. p0 = for some 1 < ; < /. In this case Step[l]fails by our assumption on gi 

2. p0 7^ gL for all 1 < ; < /. In this case. 



Pr.eFj^W &3ie{l /} : g{x)=gj{x)] 

< Pr;,eF, [g{x) = P(Z){x) & 3; G {!,. . .,/} : g{x) = g'{x)] (Since Step [s] accepts) 
= Pr,eFj3 7G {!,...,/} : p^ix) = gi{x)] 

< Id/q 

The last inequality uses the fact that any two distinct degree d polynomials can agree on at 
most d/ q fraction of the points followed by a union bound. 



Inductive Case: M = N We again consider two cases as before: 

1. P0 = ^0 for some 1 < ; < /. In this case Step[l]fails by our assumption on gL 
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2. p0 7^ gQ for all 1 < / < /• In this case, the fraction of points fl G such that 



{a,b2, . . . ,bN) = P(z,{a) 

b2,...bt,G{0,l} 



(A.1) 



for some 1 < < / is at most Id/q. 

Note that for a fixed a G Fg, Steps|2]and|3]are equivalent to running the Sum Check Protocol 



for checking 



fo2,...fcNG{0,l} 



where c' =^ For x G F?^ ^, let Va {x) be the event that this protocol accepts. 



If Equation A.l does not hold for any 1 < j < I then we can use the inductive assumption to 
get 



Pr 



Va{x) & 3; G {!,...,/} : g{a,x)=g!{a,x) <{N-l)dl/q 



Thus, the total probability of acceptance is at most Id/ q + {N — l)dl/q < Ndl/q. 



□ 
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